CVE-2026-77130
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
Risk Assessment
An attacker with a stolen API key can maintain access even after token expiration, increasing the risk of unauthorized access.
Recommendation
Update the extension to a version with proper JWT expiration validation and regularly rotate API keys.
Other vulnerabilities in TYPO3 SYSSY extension
Original NVD description (English source)
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.